| 标题 | Emlog Emlog Pro 2.5.19 Cross Site Scripting |
|---|
| 描述 | article_save.php contains a critical stored cross-site scripting (XSS) vulnerability fundamentally caused by the absence of effective input sanitization and output encoding mechanisms for user-submitted article data (including titles, body content, and excerpts). This allows malicious scripts to be persistently stored in the database unchanged. When this contaminated data is subsequently rendered in article.php's administrative interfaces (such as article listings or edit pages) or public-facing article displays, browsers directly parse and execute embedded JavaScript payloads. Attackers can exploit this to craft malicious scripts enabling cookie theft, session hijacking, or back-end system takeover, triggered when administrators or regular users view compromised articles. This creates a complete attack chain from data storage to display. Crucially, the lack of HTML whitelist filtering for rich text content ($logcontent) enables injection of arbitrary complex HTML/JavaScript code, significantly expanding the vulnerability's threat surface and potential impact. |
|---|
| 来源 | ⚠️ https://github.com/chen2496088236/CVE/issues/6 |
|---|
| 用户 | 111ctx (UID 89466) |
|---|
| 提交 | 2025-08-28 12時26分 (1 年前) |
|---|
| 管理 | 2025-09-11 17時13分 (14 days later) |
|---|
| 状态 | 重复 |
|---|
| VulDB条目 | 297627 [Emlog Pro 2.5.4 article_save.php postStrVar 跨网站脚本] |
|---|
| 积分 | 0 |
|---|